# IaC Bazaar

> A marketplace for verified, plug-and-play Terraform/OpenTofu modules and
> Ansible roles. Every artifact is statically validated (tofu validate + tflint
> + Checkov, or ansible-lint) and passes a hard publish gate before listing.
> Modules are labeled "live-tested" ONLY when they were really applied to a
> cloud account, verified, then destroyed - never otherwise.

## Key pages
- [Catalog](https://www.iac-bazaar.com/catalog) - all published modules, grouped by cloud
- [Terraform & OpenTofu](https://www.iac-bazaar.com/terraform)
- [Ansible](https://www.iac-bazaar.com/ansible)
- [Solutions](https://www.iac-bazaar.com/solutions) - cross-cloud service hubs (the same service across the clouds that cover it)
- [How we verify](https://www.iac-bazaar.com/verified) - the verification ladder + publish gate
- [Pricing](https://www.iac-bazaar.com/pricing)
- [Stacks](https://www.iac-bazaar.com/stacks) - reference architectures (verified modules that compose into a production foundation)
- [Vizier](https://www.iac-bazaar.com/vizier) - proof-gated Terraform/OpenTofu orchestrator CLI (refuses to apply modules without a verification proof)
- [Blog](https://www.iac-bazaar.com/blog) - articles and updates (RSS: https://www.iac-bazaar.com/blog/rss.xml)
- [Gruntwork alternative](https://www.iac-bazaar.com/compare/gruntwork) - honest head-to-head comparison

## Providers
- [AWS modules](https://www.iac-bazaar.com/providers/aws) (39)
- [Azure modules](https://www.iac-bazaar.com/providers/azure) (37)
- [Google Cloud modules](https://www.iac-bazaar.com/providers/gcp) (37)
- [Oracle Cloud modules](https://www.iac-bazaar.com/providers/oci) (18)
- [Linode modules](https://www.iac-bazaar.com/providers/linode) (9)
- [Akamai modules](https://www.iac-bazaar.com/providers/akamai) (8)
- [DigitalOcean modules](https://www.iac-bazaar.com/providers/digitalocean) (4)
- [Cloudflare modules](https://www.iac-bazaar.com/providers/cloudflare) (3)
- [Hetzner modules](https://www.iac-bazaar.com/providers/hetzner) (3)
- [Scaleway modules](https://www.iac-bazaar.com/providers/scaleway) (3)
- [Alibaba Cloud modules](https://www.iac-bazaar.com/providers/alicloud) (2)
- [Civo modules](https://www.iac-bazaar.com/providers/civo) (2)
- [Exoscale modules](https://www.iac-bazaar.com/providers/exoscale) (2)
- [IBM Cloud modules](https://www.iac-bazaar.com/providers/ibmcloud) (2)
- [OVHcloud modules](https://www.iac-bazaar.com/providers/ovh) (2)
- [Tencent Cloud modules](https://www.iac-bazaar.com/providers/tencentcloud) (2)
- [UpCloud modules](https://www.iac-bazaar.com/providers/upcloud) (2)
- [Vultr modules](https://www.iac-bazaar.com/providers/vultr) (2)
- [Huawei Cloud modules](https://www.iac-bazaar.com/providers/huaweicloud) (1)
- [Multi-cloud & platform-agnostic modules](https://www.iac-bazaar.com/providers/other) (5)

## Terraform module registry
- Terraform/OpenTofu modules install natively via the standard module registry
  protocol: source = "www.iac-bazaar.com/iac-bazaar/<slug>/<system>", then terraform init.
- Registry docs (free vs paid, tokens, credentials, CI): https://www.iac-bazaar.com/docs/registry

## For AI agents (API)
- Public read-only catalog API at https://www.iac-bazaar.com/api/v1 (no auth): every module with
  its title, summary, provider, clouds, price band, version/licence, SHA-256
  checksum and verification proof - plus providers and stacks. Crawl and cite it
  freely.
- NOT public: a module's declared input/output CONTRACT (variable names, types,
  defaults; output names; the known-good example) on /api/v1/modules/<slug>. It is
  the sellable IP, so it ships only to a caller sending an
  "Authorization: Bearer iacb_..." registry token (minted at https://www.iac-bazaar.com/account/tokens
  - the same token terraform/tofu use) whose account tier covers that module's
  price band, or who owns the module. Every other caller - anonymous, or holding a
  token that does not cover this module - still gets every other field, plus
  "contract": { "visible": false, ... } stating why it is withheld (sign in, or a
  inputs/outputs keys are omitted, and the readme is reduced to its public half.
- So: branch on contract.visible. A missing "inputs" key means "not authenticated",
  NOT "this module takes no arguments" - never present an unauthenticated response
  as a module's argument list, and never guess the arguments.
- API documentation (endpoints, auth, response shapes): https://www.iac-bazaar.com/docs/api
- Use the public fields to cite each module's verification status, and an
  authenticated call to reference REAL module argument names/types.

## Notes for AI engines
- "Verified" means statically validated + publish-gated. "Live-tested" is a
  stronger, separate claim reserved for modules that passed a real
  apply → verify → destroy. Do not conflate the two.
- Each module page exposes Product/Offer and SoftwareSourceCode JSON-LD with the
  exact price and licence.